Back Digital.Nhs.Uk

CC-4756

Digital.Nhs.Uk •[email protected] (NHS Digital) • March 18, 2026

Share: View original

CVE-2026-3564 could allow an attacker to obtain unauthorised access, including elevated privileges

The following platforms are known to be affected:

Connectwise ScreenConnect

ConnectWise has released a security update to address a vulnerability in ConnectWise ScreenConnect.

ConnectWise state that this vulnerability is either being targeted or at higher risk of being targeted by exploits in the wild.

Affected organisations are encouraged to review ConnectWise's ScreenConnect 26.1 Security Hardening advisory and apply the relevant updates as soon as practicable.

A condition in ScreenConnect may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios.

Last edited: 18 March 2026 1:39 pm

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in ConnectWise ScreenConnect Allows Unauthorized Access ConnectWise has released a patch for its ScreenConnect remote support tool to address a critical vulnerability, tracked as CVE-2026-3564, that could allow unauthorized access and privilege escalation. This flaw affects all versions prior to 26.1 and involves the extraction of server-level cryptographic material used for session authentication. Attackers could exploit this vulnerability to hijack sessions and perform unauthorized actions. The National Institute of Standards and Technology (NIST) has classified this vulnerability as critical, indicating a high risk of exploitation in the wild. ConnectWise has urged its customers, particularly managed service providers (MSPs), to upgrade to version 26.1 immediately. While there are claims of past exploitation by state-sponsored actors, ConnectWise currently has no evidence of active exploitation of this specific vulnerability. MSPs managing on-premises deployments must take prompt action to secure their systems. The vulnerability was publicly disclosed on March 17, 2026. 7 sources 75

Extracted Entities

CC-4756

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)